c1325391f2a2ba9a56a97e44ed8f308abbb00d96007a79f52796d34cfa60d0cc

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 06:41

Target

$PLUGINSDIR/InstallOptions.dll
Size

14KB
MD5

79be350c8381293abb045bbd2a7b5f0a
SHA1

0b4e6d482cae461e36c2b47661ef586545162e23
SHA256

3091623495d6e81bc0aa9182a55b0f93d3b2238102a44fd66943e46ed7eeaf51
SHA512

1d39bc13f2825bb4aee5832bc5c60603b62b3475e0075028a146981764e6796e68fdd752627f37f8bb198dcfce5a62efb6a6283366fc4874a8915008aa0a4c28
SSDEEP

192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3056	1964	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 2352 wrote to memory of 1964	2352	rundll32.exe	28
PID 1964 wrote to memory of 3056	1964	rundll32.exe	29
PID 1964 wrote to memory of 3056	1964	rundll32.exe	29
PID 1964 wrote to memory of 3056	1964	rundll32.exe	29
PID 1964 wrote to memory of 3056	1964	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 244
    3⤵
    - Program crash
    PID:3056